A data governance team must add a custom CostCentre tag to user accounts and then build dynamic groups whose membership keys off that value. The tag must be a first-class directory attribute that dynamic membership rules can reference, without overloading a built-in attribute. Which Microsoft Entra capability should they use?
- APopulate one of the directory extension attributes (extensionAttribute1 to 15) on each user with the CostCentre value, then reference that field in the dynamic membership rule. Correct
- BDefine a custom security attribute in an attribute set, assign the CostCentre value to each user, and delegate the attribute set to the governance team.
- CCreate an administrative unit named for each cost centre and place the matching users inside it to represent the tag.
- DStore the cost centre in the built-in department attribute and reference department in the dynamic membership rule.
Why A is correct: Directory extension attributes are custom directory fields that dynamic membership rules can reference, so they provide the first-class custom tag that drives dynamic group membership keyed off the CostCentre value.
Why B is wrong: Custom security attributes give governed, delegated tagging, but Microsoft Entra does not support them in dynamic membership group rules, so they cannot drive the dynamic groups the requirement needs.
Why C is wrong: Administrative units scope delegated administration over a set of objects; they are not an attribute on the user and cannot be referenced by dynamic membership rules, so they do not implement a tag.
Why D is wrong: The department field can be used in dynamic rules, but it is a built-in attribute with an existing HR meaning, so overloading it for CostCentre is not a dedicated custom tag and risks conflicts with existing processes.